READY-TO-ASSEMBLE-LEGO1-PATCH2 — Codex Review Packet — 2026-06-22

For Codex re-review. Verdict: READY_TO_ASSEMBLE_LEGO1_PATCH2_HOLD_DOT_DIRECTUS_PATH_INCOMPLETE. Ready to request dry-run auth: NO · run now: NO · REGISTRATION_HOLD ACTIVE · CAN_PROCEED=NO · P2/named lane CLOSED · 0 mutations · DO NOT IMPLEMENT.

1. Codex findings reproduced from live evidence (all REAL)

ID	Live evidence (this session, read-only)	Status
R1 dispatcher no REAL_RUN	fn_process_agent_api_dispatch RAISES on REAL_RUN	REAL
R2 create_collection≠schema	fn_iu_collection_create→iu_piece_collection; no Directus-DDL in 54-cmd catalog	REAL
R3 C1 pair absent	c1_contracts=0, c1_dot_tools=0, c1_table=0	REAL
R4 PF7 wrong contract	v_dotkg_realrun_preflight DOT_KG-specific; c1_preflight_views=0	REAL
R5 status granted impossible	domain {draft,active,consumed,expired,revoked}; auth_count=0	REAL
R6/R7 @> superset	corrected to set-equality	REAL (design)
R8 resolver join 0	apr_active=14,pav_total=12,joined=0; different namespaces	REAL
R9 harness unrelated	fn_iu_bcf_harness_run = IU axis B/C/F	REAL
R10 cser no bytes	now real bytes+digest	REAL→CLOSED
R11 comp labels	governed handlers needed	REAL
R12 blast-radius omits artifacts	now listed	REAL→CLOSED

2. Closure map

CLOSED: B2(→AUTHORITY), B3(→AUTHORITY_MISSING_ONLY), B8, B9, B10, B11, B12. PREPARATION_GAP (executable contract absent; PATCH2 forbidden to create): B1, B4, B5, B6, B7.

3. Why HOLD, not READY

Your §5.1: "actual registered artifacts and read-only definition evidence … the executable contract may not [be absent]." The C1 schema DOT, producer/verifier pair, value-admit + auth-consume handlers, build-run/compensation, C1 harness, and C1 preflight view do not exist; registering them is DML/DDL/registration, forbidden under REGISTRATION_HOLD/0-mutation. Spec (Form B) ≠ registered artifact. So the preparation gap is irreducible within PATCH2.

4. Corrected blueprint (for the future Gate-B build-prep)

• REAL_RUN via executor …:8090/dispatch + governed promotion — not the dispatcher.
• Schema via new DOT_C1_SCHEMA_ENSURE (+table_registry) — not dot_iu_create_collection.
• Values via DOT_C1_VALUE_ADMIT — not IU staging gateway, not raw INSERT.
• Verifier status='active' + exact set-equality + esign authenticity + approved-request binding.
• Consume before writes via governed handler in one txn — not raw DML.
• R_C1 over apr_action_types' own columns — not the 0-row process_axis join.
• C1-specific v_c1_realrun_preflight and fn_c1_vocab_harness_run.
• cser-v1 real digest 2ab1f90b… (value), recompute command in file 09.

5. Ask of Codex

Confirm the reproduction + corrected blueprint, and confirm that the next gate is a build-prep authorization to register the C1 executable contracts (not dry-run authorization, not P2/named-lane, not registration of C1 itself). 14 files under …/reports/ready-to-assemble-lego1-patch2/ + rollup.